[Bug symtab/29168] New: [gdb/UB] gdb/dwarf2/read.c:17545:20:runtime error: shift exponent 127 is too large for 64-bit type 'long unsigned int'

[Bug symtab/29168] New: [gdb/UB] gdb/dwarf2/read.c:17545:20:runtime error: shift exponent 127 is too large for 64-bit type 'long unsigned int'

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29168

            Bug ID: 29168
           Summary: [gdb/UB] gdb/dwarf2/read.c:17545:20:runtime error:
                    shift exponent 127 is too large for 64-bit type 'long
                    unsigned int'
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: symtab
          Assignee: unassigned at sourceware dot org
          Reporter: vries at gcc dot gnu.org
  Target Milestone: ---

I build gdb with -fsanitize=undefined, and ran into:
...
(gdb) break foo.adb:40^M
^[[1m/data/vries/gdb_versions/devel/src/gdb/dwarf2/read.c:17545:20:^[[1m^[[31m
runtime error: ^[[1m^[[0m^[[1mshift exponent 127 is too large for 64-bit type
'long unsigned int'^[[1m^[[0m^M
ERROR: GDB process no longer exists
GDB process exited with wait status 26953 exp9 0 1
UNRESOLVED: gdb.ada/arrayptr.exp: scenario=all: gdb_breakpoint: set breakpoint
at foo.adb:40 (eof)
ERROR: Couldn't run foo
...

It's related to the negative_mask assignment here:
...
  /* Normally, the DWARF producers are expected to use a signed
     constant form (Eg. DW_FORM_sdata) to express negative bounds.
     But this is unfortunately not always the case, as witnessed
     with GCC, for instance, where the ambiguous DW_FORM_dataN form
     is used instead.  To work around that ambiguity, we treat
     the bounds as signed, and thus sign-extend their values, when
     the base type is signed.  */
  negative_mask =
    -((ULONGEST) 1 << (TYPE_LENGTH (base_type) * TARGET_CHAR_BIT - 1));
  if (low.kind () == PROP_CONST
      && !base_type->is_unsigned () && (low.const_val () & negative_mask))
    low.set_const_val (low.const_val () | negative_mask);
  if (high.kind () == PROP_CONST
      && !base_type->is_unsigned () && (high.const_val () & negative_mask))
    high.set_const_val (high.const_val () | negative_mask);
...

With base type of 16 bytes:
...
(gdb) p *base_type
$2 = {pointer_type = 0x0, reference_type = 0x0, rvalue_reference_type = 0x0, 
  chain = 0x3bf43c0, align_log2 = 0, m_instance_flags = 0, length = 16, 
  main_type = 0x3bf4400}
      bit_offset = 454}}, dyn_prop_list = 0x0}
(gdb) p base_type.main_type.name
$4 = 0x7ffff42399e5 "long_long_long_unsigned"
...
we're shifting a 64-bit value by 127 (16 * 8 - 1).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29168] [gdb/UB] gdb/dwarf2/read.c:17545:20:runtime error: shift exponent 127 is too large for 64-bit type 'long unsigned int'

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29168

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
Related PR: PR28127

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug symtab/29168] [gdb/UB] gdb/dwarf2/read.c:17545:20:runtime error: shift exponent 127 is too large for 64-bit type 'long unsigned int'

[tromey at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29168

Tom Tromey <tromey at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
                 CC|                            |tromey at sourceware dot org
   Target Milestone|---                         |14.1

--- Comment #2 from Tom Tromey <tromey at sourceware dot org> ---
I think this was fixed by:

commit b70bff5ea52550c7cd48af7579a75ac2624ec13d
Author: Simon Marchi <simon.marchi@polymtl.ca>
Date:   Fri Jan 20 11:51:54 2023 -0500

    gdb/dwarf: fix UBsan crash in read_subrange_type


I think this went in on master but not gdb-13.

-- 
You are receiving this mail because:
You are on the CC list for the bug.